| Name | CVE-2016-6254 |
| Description | Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-575-1, DSA-3636-1 |
| Debian Bugs | 832507 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| collectd (PTS) | jessie, jessie (lts) | 5.4.1-6+deb8u1 | fixed |
| stretch | 5.7.1-1.1 | fixed |
| buster | 5.8.1-1.3 | fixed |
| bullseye | 5.12.0-7 | fixed |
| bookworm | 5.12.0-14 | fixed |
| sid, trixie | 5.12.0-22 | fixed |
The information below is based on the following data on fixed versions.
Notes
https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18
https://github.com/collectd/collectd/commit/8b4fed9940e02138b7e273e56863df03d1a39ef7